Error 521: Web Server Is Down

The short version: Reload after a minute: a 521 sits on the website's side and you cannot fix it as a visitor. It means the origin server refused Cloudflare's connection outright. Run the website yourself? Check the web server is actually running, that it listens on the port your SSL/TLS mode requires, and that nothing is rejecting Cloudflare IP ranges.

Key takeaways

• Your origin server actively refused the connection from Cloudflare. Something was listening and answered with a reset rather than staying silent.
• This is the website's problem, not yours. As a visitor there is nothing to fix beyond waiting and reloading.
• Cloudflare names two causes above all others: the web server application is offline, or Cloudflare's requests are being blocked.
• A refusal is diagnostically better news than silence. It means the machine is up and reachable, so the fault is a stopped service or a rejecting rule rather than a dead host or a broken route.
• If your SSL/TLS mode is Full or Full (Strict), the origin must serve HTTPS on port 443. A server listening only on port 80 in that mode produces a 521 every time.

Error type

Cloudflare 5xx edge error

Whose side

Always the website

Fix difficulty

Moderate (website owner)

Common cause

Origin service stopped or refusing Cloudflare

What does Error 521: Web Server Is Down mean?

A 521 Web Server Is Down is a Cloudflare-specific status code that appears when your origin web server refuses the connection Cloudflare tries to open. The name overstates it slightly: the machine is usually up and reachable, and something on it is answering the knock with a refusal.

Because the refusal happens between Cloudflare and the server behind it, a 521 is always a problem with the website's infrastructure. Your browser, device, and connection play no part in it.

521

Cloudflare status code

RST

What the origin sent back

443

Port needed for Full and Full (Strict)

2

Causes Cloudflare names most often

How the Error 521: Web Server Is Down error appears

The wording changes depending on your browser, device, or server. Here is how this error commonly shows up:

example.com

521

Web server is down

The origin server refused the connection.

• Error 521: web server is down
• Error 521 Cloudflare
• Web server is down Error code 521
• HTTP 521
• Host Error: web server is down
• Cloudflare 521 origin down

521 vs 522, 524 and 502

The Cloudflare 5xx codes each record a different outcome of the same attempt to reach your origin. Reading them precisely saves a lot of guessing.

Which port your origin must listen on

A frequent 521 has nothing to do with firewalls: the origin is running, but on the wrong port for the SSL/TLS mode Cloudflare is using. These have to match.

What causes Error 521: Web Server Is Down?

• The web server application (nginx, Apache, Node, and so on) has stopped, crashed, or was never started after a reboot.
• A firewall or security product at the origin is rejecting Cloudflare IP ranges rather than allowing them.
• Your SSL/TLS mode is Full or Full (Strict) but the origin only listens on port 80, so nothing accepts the HTTPS connection.
• Your SSL/TLS mode is Full (Strict) and the origin certificate is missing, expired, or not from a trusted CA.
• The web server is bound to 127.0.0.1 instead of a public interface, so external connections are refused.
• The origin ran out of resources and the service was killed, for example by the kernel out-of-memory reaper.

How to find the cause fast

1. Reload once after a minute, then check from elsewhere with Is Website Down? to confirm it is failing for everyone.
2. Owners: run nc -vz YOUR_ORIGIN_IP 443. "Connection refused" confirms a 521 and rules out the packet dropping behind a 522.
3. Check the service is alive and bound where you expect with systemctl status nginx and ss -lntp | grep -E ":80|:443". A service bound only to 127.0.0.1 shows up here immediately.
4. Match your Cloudflare SSL/TLS mode against the port the origin actually listens on. Full and Full (Strict) both require HTTPS on 443.
5. Read the origin error log around the failure timestamps. A crash leaves an entry; a firewall rejection does not, and that absence is itself informative.

Terminal

curl -sI https://example.comHTTP/1.1 521 Origin DownServer: cloudflare# refused, not silent, is the tell:nc -vz 203.0.113.10 443nc: connect to 203.0.113.10 port 443 failed: Connection refused

How Error 521: Web Server Is Down looks from the outside

A 521 comes back as a complete HTTP response from the Cloudflare edge, so an external check sees a fast reply carrying a 521 rather than an unreachable host. Recording the exact code is what makes the trio useful: 521 means the origin refused, 522 means it never answered, 524 means it answered then went quiet. A 521 that starts at the same instant across every checking location almost always means a service died or a rule changed, both of which need someone now rather than in the morning.

To confirm the exact code a URL returns, or to re-test several at once after a fix, run them through the free bulk URL status checker.

How to fix Error 521: Web Server Is Down

If you are a visitor

1. Wait a minute and reload. A 521 caused by a crashed service often clears the moment it restarts.
2. Try a different browser or a private window to rule out a cached error page.
3. Check whether it is down for everyone with Is Website Down? If it is, only the owner can fix it.
4. Nothing on your side is involved. A 521 is a conversation between Cloudflare and the website's server.

If you run the website

1. Confirm the web server process is actually running, and restart it if not. This is the single most common cause.
2. Check what the server is listening on with ss -lntp. It must be bound to a public interface, not just 127.0.0.1.
3. Match the port to your SSL/TLS mode: port 80 for Flexible, port 443 for Full and Full (Strict).
4. On Full (Strict), install a certificate from a trusted CA or a Cloudflare Origin Certificate. A missing or expired one refuses the connection.
5. Allow every Cloudflare IP range in your firewall and any security plugin. Rejecting them produces a 521 where dropping them would produce a 522.
6. Look for out-of-memory kills or crash loops in the system journal if the service keeps stopping on its own.

Still not fixed? Next steps

• Confirmed the service is running and the port is right, and still getting 521? Ask your host whether a provider-level firewall or security product is rejecting Cloudflare IP ranges before traffic reaches your machine.
• Check whether the refusal is constant or intermittent. A service that crashes and restarts under load produces 521s in bursts that line up with your traffic peaks.
• Review the origin error log around the exact timestamps. A 521 caused by an application crash almost always leaves a matching entry; one caused by a firewall leaves nothing at all.
• On a managed stack where you cannot inspect firewalls or ports, give your host the affected hostname, the Cloudflare IP from your logs, and exact timestamps so they can trace the rejected connection.

How to prevent Error 521: Web Server Is Down

A 521 is usually binary: the service is up or it is not, and every visitor sees the error the moment it stops. That makes it one of the most damaging failures to discover late, and one of the easiest to catch early. Pulsetic checks your website from multiple locations as often as every 30 seconds, records the exact status code, and alerts you by email, SMS, voice call, Slack, Discord, and more the instant 521s begin. It will not restart the service for you, but you will know it stopped within seconds rather than hearing it from a customer.

Learn how Pulsetic's uptime monitoring detects this from the outside, across 15+ locations.

Sources and further reading

The specifications and vendor documentation this guide is written from, plus deeper reading on the parts it only summarises.

• Cloudflare: Error 521 (web server is down)
• Cloudflare IP ranges to allowlist
• Cloudflare: SSL/TLS encryption modes